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REMARKS 



Reconsideration of this application is respectfully requested in view of the foregoing 
amendment and the following remarks. 

Claims 2-21 were pending in this application. No claims have been amended, cancelled, 
or withdrawn. Accordingly, claims 2-21 will be pending herein upon entry of this Amendment. 
For the reasons stated below. Applicants respectfully submit that all claims pending in this 
application are in condition for allowance. 

Examiner Tran is thanked for the courtesies extended to applicants' representative during 
the telephone interview conducted April 1 5, 2005. The substance of the interview is 
incorporated into the following remarks. 

Claims 2-21 have been rejected under U.S.C. 103(a) as being unpatentable over Shostack 
et al. U.S. Patent No. 6,298,445 (hereinafter '445) in further view of Gooderum et al. U.S. Patent 
No. 6,219,707 (hereinafter '707). In regard to the preamble of independent claim 2, the 
Examiner suggests that "A method for preventing process creation of an unauthorized user 
application executable by an operating system of a computer, comprising" is taught in '445 col. 
2, line 60 through coL3, line 6 "In another aspect, the invention relates to a network security 
detector that is used to monitor intrusions on a network . . .and a fifth application responsible for 
receiving the software enhancements." 

The Examiner has not clearly described what she considers to be equivalent between the 
preamble of claim 2 and '445. As a result. Applicants must make some assumptions. If the 
Examiner is equating "an unauthorized user application executable" with "security intrusions," 
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then she is equating "preventing process creation of with "monitor," and she is equating 
"preventing. . .by an operating system" with "monitor. . .on a network." Applicants respectfully 
disagree that "preventing process creation of is equivalent to "monitor," or that 
"preventing. . .by an operating system" is equivalent to "monitor. . .on a network." 

Further, the Examiner says '445 also teaches a "fifth application responsible for receiving 
the software enhancements." The "fifth application" is clearly described in '445 as an 
application of a network security detector. Thus, the Examiner may also be equating "preventing 
process creation of an unauthorized user application executable" with "receiving the software 
enhancements." The examiner is then equating "preventing process creation of with 
"receiving" and "an unauthorized user application executable" with "software enhancements." 
Again, applicants respectfully disagree and contend that "receiving" is not equivalent to 
"preventing process creation of," and "software enhancements" is not equivalent to "an 
unauthorized user application executable." 

Even combined the Examiner's references fi-om '445 do not equate to the preamble of 
claim 2. The action of "preventing process creation of is not equivalent to the combined action 
of "monitoring" and "receiving." In addition, "security intrusion software enhancements" does 
not make sense, and even if it did make sense "an unauthorized user application executable" is 
not equivalent to "security intrusion software enhancements." 

The Examiner then combined claim elements 2 and 4 of claim 2, "intercepting a request 
for execution of an application executable by a user using the substitute process creation 
function" and "comparing the information to a list of authorized executables for the user using 
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the user-mode application," and said they are shown in '445 col. 8, lines 9-54, "The push system 
integrates the software enhancement in to existing programs. Additionally, the integration can 
also perform a check on the integrity and authenticity of the sofl^vare enhancement provided. 
This feature determines whether the user being sent the software enhancement is eligible, and 
checks the integrity and authenticity of the software enhancement." 

The Examiner here also has not clearly described what she considers to be equivalent 
between the referenced elements 2 and 4 of claim 2 and '445, and Applicants must make some 
assumptions. If the Examiner is equating "comparing the information to a list of authorized 
executables for the user" with "determines whether the user being sent the software enhancement 
is eligible," then "using the user-mode application" is equivalent to "the push system," and 
"authorized executables" is equivalent to "the software enhancement." Applicants respectfiiUy 
disagree that "using the user-mode application" is equivalent to "the push system," and 
"authorized executables" is equivalent to "the software enhancement." 

In addition, there appear to be no equivalent phrases to "intercepting a request for 
execution of an application executable by a user using the substitute process creation fiinction" in 
the section provided by the Examiner. The action of "intercepting a request for execution of an 
application executable" is not equivalent to "integrates the software enhancement" or "perform a 
check on the integrity and authenticity of the software enhancement." Applicants submit that 
claim 2 elements 2 and 4, "intercepting a request for execution of an application executable by a 
user using the substitute process creation fiinction" and "comparing the information to a list of 
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authorized executables for the user using the user-mode application," are not shown in '445 col. 
8, lines 9-54. 

The Examiner suggests claim element 3 of claim 2, "communicating information about 
the request from the substitute process creation function to a user-mode application running as a 
service," is disclosed in '445 col. 7, lines 55-56, "The push system automatically implements and 
electronically sends computer software enhancements over a computer network when the 
software enhancement becomes available. The software enhancement can include an update to a 
computer security vulnerabilities database or a new version of an entire computer security 
software package." 

The Examiner here also has not clearly described what she considers to be equivalent 
between the referenced element of claim 2 and '445, and Applicants must make some 
assumptions. If the Examiner is equating "communicating information about the request" with 
"implements and sends computer software enhancements," then the Examiner is equating 
"information about the request" with "software enhancements", "the substitute process creation 
fiinction" with "the push system," and "from the substitute process creation function to a user- 
mode application running as a service" with "over a network." Applicants respectfiiUy disagree 
that "information about the request" is equivalent to "software enhancements", "the substitute 
process creation function" is equivalent to "The push system" and "from the substitute process 
creation function to a user-mode application running as a service" is equivalent to "over a 
network." 
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Further, Applicants point out the Examiner appears to be equating "using the user-mode 
application" with "the push system" in claim element 4 and "the substitute process creation 
function" with "the push system" in claim element 3 of claim 2. This is inconsistent. 

Applicant's respectively submit that claim 2 is not unpatentable over *445 and is 
allowable. For at least the arguments made above in regard to claim 2, Applicant's also submit 
that independent claims 15 and 20 are not unpatentable over *445 and are allowable. Since 



In view of the foregoing all of the claims in this case are believed to be in condition for 
allowance. Should the Examiner have any questions or determine that any further action is 
desirable to place this application in even better condition for issue, the Examiner is encouraged 
to telephone applicants' undersigned representative at the number listed below. 



independent claims 2, 15, and 20 are allowable, dependent claims 3-14,16-19, and 21 are also 



allowable. 



PILLSBURY WINTHROP 
SHAW PTTMAN LLP 



1 650 Tysons Boulevard 
McLean, VA 22102 
Tel: 703/770-7900 
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